Your own Kasm Workspaces server: desktops in the browser for your team

Will one server be enough for your team?

For most small teams, yes. The question to ask is how many people will have a desktop open at the same moment, because that, not the number of accounts, is what uses the machine. Kasm's documentation gives two numbers to work from: Kasm's own services need at least two cores plus 4 GB of RAM, and each standard desktop is set to require 2,768 MB of memory and two CPU cores. If the server cannot spare that, the next desktop simply does not start.

Those totals are our own sums from Kasm's two figures, rounded up. You can give each desktop more or less in its Workspace settings, and the totals move with it. Add swap as well: Kasm recommends a swap partition for stable sessions, and the installer offers to create one. And whatever the size, give it at least 75 GB of SSD where Docker keeps its files: every desktop type you add is another image on that disk.

What a server of your own changes

Kasm's documentation suggests a single-purpose machine and letting its installer set up Docker for you. A dedicated server gives you exactly that: one physical computer running your work and nobody else's, with root access so the installer can do its job. Every core and every gigabyte goes to your team's desktops. Start from a clean system and let Kasm bring Docker itself: if an older Docker than Kasm supports is already installed (version 28.5.2 is the minimum it lists), the install stops, while an out-of-date Docker Compose is simply swapped for a compatible one.

• Streaming desktops moves a lot of data. The port is unmetered, so there is no allowance to run over and no bandwidth line on the invoice.
• A firewall mistake is not the end. Every rack server and blade includes a remote console, as do two cartridge models (m510, m710x): you get the screen and the power button even when SSH stops answering.
• Starting over is free. Wipe and reinstall the operating system yourself, any number of times, without opening a ticket.
• No contract. It is month to month, and a ready server is handed over within 30 minutes of the payment being approved.

Desktops feel slow when the server is far away, so pick the city closest to the people using them from the data center locations. Choose Ubuntu 22.04 or 24.04 when you order; both are on the supported list for Kasm 1.19.0, alongside Debian 11 to 13, RHEL 8 to 10, and releases 8 and 9 of AlmaLinux, Rocky and Oracle Linux. Avoid the ARM cartridge, which only installs Ubuntu 16.04 or 18.04.

Lock the door before you install

Before Kasm goes on, switch on the firewall so only SSH gets in. The first line makes ufw protect IPv6 too; it has to come before any allow rule, because rules added earlier get no IPv6 version.

sudo sed -i 's/^IPV6=.*/IPV6=yes/' /etc/default/ufw
sudo ufw default deny incoming
sudo ufw allow 22/tcp
sudo ufw --force enable
sudo ufw status verbose

Installing it, one step at a time

1. Open Kasm's single-server installation page and note the current installer file name. The example below uses version 1.19.0, the one listed when this page was written.
2. Download the installer bundle to /tmp together with the .sha256sum file Kasm publishes beside it, and let sha256sum --check compare the two. If it does not say OK, stop there; the commands below will not go on.
3. Unpack it and run the installer script from the unpacked folder with sudo bash. You are running a file you downloaded and checked, never a script fetched straight into your shell.
4. Answer the licence prompt, and the swap question if your server has no swap yet.
5. When it finishes, open https:// followed by your server's address in a browser. Expect a certificate warning: Kasm makes its own self-signed certificate until you add a real one.

cd /tmp
curl -fO https://kasm-static-content.s3.amazonaws.com/kasm_release_1.19.0.tar.gz
curl -fO https://kasm-static-content.s3.amazonaws.com/kasm_release_1.19.0.tar.gz.sha256sum
sha256sum --check kasm_release_1.19.0.tar.gz.sha256sum && \
  tar -xf kasm_release_1.19.0.tar.gz && \
  sudo bash kasm_release/install.sh

If something goes wrong, the installer leaves a log called kasm_install_ plus a timestamp in the folder you ran it from. A clean install deletes it. Since 1.19.0 your desktops use rolling images that keep picking up security fixes; if you would rather update them by hand, add -f to the install command for static images.

The two passwords on your screen

The last thing the installer shows you is a pair of logins: admin@kasm.local for running the system and user@kasm.local for an ordinary desktop user, each with a random password. Save both in your password manager right then, before the terminal scrolls away, and change them after your first login.

The installer can take your own passwords with --admin-password and --user-password, but we suggest you let it generate them. Anything you type on a command line is kept in your shell history and can be seen by other processes on the machine while the install runs.

Keeping strangers out while you set things up

Here is the catch with Docker: the firewall you just enabled does not cover port 443. Docker sends traffic for a published container port through its own rules first, so on IPv4 those packets never reach ufw's rules. Docker's own documentation says to put your restrictions in a chain called DOCKER-USER. While you finish setting up, allow only your own address in:

# replace eno1 with your public interface (ip route show default)
# replace 203.0.113.10 with the address you connect from
sudo iptables -I DOCKER-USER -i eno1 ! -s 203.0.113.10 -j DROP
sudo iptables -I DOCKER-USER -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

The second rule keeps your desktops' own web browsing working. Both rules cover IPv4 only and vanish when the server restarts. Whether Docker also answers on IPv6, and through which route, depends on its version and settings, so if you added an IPv6 address to the server, check from an outside connection whether port 443 answers over IPv6. When you are ready to open up, delete the first rule with the same line, -D in place of -I.

Is the free edition enough for you?

It depends on who you are. Kasm's licensing page offers Community Edition free for testing, for nonprofit work, and for "eligible non-commercial use". It allows up to 5 sessions running at once, and help comes from the community through Kasm's public issue tracker. For business use, Kasm sells commercial licences on two models, Named User and Concurrent Session: pay for the people who use it, or for how many sessions run at once. Ask Kasm for a price at kasm.com/quote.

If you buy a key, you can activate during install by saving it to a file and adding -a and that file's name to the install command. The server has to be online for that to work.

Keeping it healthy: updates and backups

You manage the server; we keep the hardware and the network running. Two jobs matter most.

• Updates: make sure nobody has a session open, take a backup, fetch the new bundle and verify it as before, then start the upgrade script from the freshly unpacked folder with --proxy-port set to the port Kasm listens on: 443, unless you picked another with -L.
• Backups: Kasm's data lives in a Postgres database inside the kasm_db container. Make a private folder with sudo mkdir -m 700 /srv/kasm-dumps, then add this to root's crontab (sudo crontab -e) for a dump every night: 30 2 * * * docker exec -i kasm_db pg_dump -Ft -U kasmapp kasm > /srv/kasm-dumps/kasm-$(date +\%F).tar 2>> /srv/kasm-dumps/errors.log
• Copy them away: a dump that sits on the server's own disks will not help if those disks fail. Move the files to another place on a schedule, and remember a restore needs the same Kasm version that made the dump.
• A real certificate: run sudo systemctl stop kasm, put your certificate and key in place of the two files under /opt/kasm/current/certs/ and bring Kasm back with sudo systemctl start kasm; or put a reverse proxy in front.

If people only need to reach Windows machines you already have, a Windows RDP server may suit you better, or an Apache Guacamole gateway if you want those machines reachable from a browser. Kasm can also bring RDP, VNC and SSH sessions into the browser alongside its own desktops.

Questions people ask

Can I use Kasm Workspaces for free?

For testing, for a nonprofit, or for eligible non-commercial use, yes: that is how Kasm's licensing page scopes Community Edition. It allows up to 5 sessions at the same time, with community support only. For other use, Kasm sells Named User and Concurrent Session licences; quotes come from kasm.com/quote.

What if I lose the admin password?

Kasm documents a recovery for self-hosted installs. You connect to the server over SSH, reset the admin account inside the kasm_db database container, log in and pick a new password straight away. Saving the generated passwords on day one saves you the trouble.

Do my users need to install anything?

No. They open the web address in a current browser: Chrome 92, Edge 92, Firefox 95, Safari 15.4 or newer. Sound does not work in mobile browsers, and copy and paste without Kasm's control panel works only in Chrome and Chromium-based browsers.

Can I run it on a port other than 443?

Yes. Add -L and the port to the install command, for example -L 8443. Remember to point your bookmarks and any firewall rules at the new port.

How long before I can start installing?

A ready server is handed over within 30 minutes of your payment being approved, with your chosen Linux already on it. The payment and fraud checks are the part whose length nobody can promise. Kasm's own install then runs on the server.